gh0strat

General

Target

63987b3405748d059a28a07f7a5e24f7fad1c6bbfcfce507b7c0aea651f02219
Size

7.0MB
Sample

241021-tp2smayelc
MD5

80fc186d5e0d36d61aa30e7806847b37
SHA1

dbfb171d5774306ff5437bdf11405c2d09771b76
SHA256

63987b3405748d059a28a07f7a5e24f7fad1c6bbfcfce507b7c0aea651f02219
SHA512

6e9f7077de1da76e05dff833bd6d8f7558441df91db9bddbe339afad4271a76745618337631ef76b22ba47e81f55c8bfb7e1a941a5aa314043286edbef83e622
SSDEEP

196608:2KXbeO7G9Ghf7Ejo+xyvsLD26vhn2IGJ3:b7GEhio0yI265GJ3

Score

10^/10

Malware Config

Targets

- Target
  
  63987b3405748d059a28a07f7a5e24f7fad1c6bbfcfce507b7c0aea651f02219
- Size
  
  7.0MB
- MD5
  
  80fc186d5e0d36d61aa30e7806847b37
- SHA1
  
  dbfb171d5774306ff5437bdf11405c2d09771b76
- SHA256
  
  63987b3405748d059a28a07f7a5e24f7fad1c6bbfcfce507b7c0aea651f02219
- SHA512
  
  6e9f7077de1da76e05dff833bd6d8f7558441df91db9bddbe339afad4271a76745618337631ef76b22ba47e81f55c8bfb7e1a941a5aa314043286edbef83e622
- SSDEEP
  
  196608:2KXbeO7G9Ghf7Ejo+xyvsLD26vhn2IGJ3:b7GEhio0yI265GJ3
Score

10^/10

gh0strat purplefox discovery persistence rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2